Agree with your overall post entirely, the thing about physical attacks is they don't scale well. If you're subject to an actual individual threat, it's a whole

Agree with your overall post entirely, the thing about physical attacks is they don't scale well. If you're subject to an actual individual threat, it's a whole different and enormously scarier/more challenging threat scenario. >Think this is still overestimating the threat. It's kinda like saying you can hack someone's password by watching video of them typing. True, but also non-trivial. Isn't that genuinely getting pretty trivial in public though? And in turn I think that is a real argument for biometrics too. The amount of over-the-shoulder camera surveillance in business and urban areas is pretty scary at this point, as are the concealability and cheapness of even very tiny spy cams. There have been plenty of scandals around it even in things like AirBNBs or hotels, historically from the context of sex, but not a stretch to imagine that passwords could be a much bigger and more lucrative target. And ML/AI is getting ever more sophisticated, and humans entering PINs/passwords is pretty repetitive behavior with a high degree of uniformity in how it's done, at least the device-unlock level. Seems very amenable to highly reliable automated analysis, to the extent I'd be genuinely surprised if that's not secretly deployed already in surveillance states. I don't enter PINs/passwords in public anymore if I can possibly help it. It just seems scalable in a way that physical attacks aren't.